Data Breach Disclosure Laws Are Not so Effective in Reducing Identity Theft …

This is the message I got from a very interesting paper, titled “Do Data Breach Disclosure Laws Reduce Identity Theft?” (Authors: Sasha Romanosky, Rahul Telang, Alessandro Acquisti), that is going to be presented at the 7th workshop on Economics of Information Security - WEIS 2008, Hanover, HN, June 25-28, 2008.

Based on their current studies, the authors found “no statistically significant effect that laws reduce identity theft, even after considering income, urbanization, strictness of law and interstate commerce”. The full abstract of a draft version of their paper (accessible online) follows:

“Identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with about 30% of known identity thefts caused by corporate data breaches. Many US states have responded by adopting data breach disclosure laws that require firms to notify consumers if their personal information has been lost or stolen. While the laws are expected to reduce losses, their full effects have yet to be empirically measured.
We use panel from the US Federal Trade Commission with state and time fixed-effects regression to estimate the impact of data breach disclosure laws on identity theft over the years 2002 to 2006. We find no statistically significant effect that laws reduce identity theft, even after considering income, urbanization, strictness of law and interstate commerce. If the probability of becoming a victim conditional on a data breach is very small, then the law’s maximum effectiveness is inherently limited. Quality of data and the possibility of reporting bias also make proper identification difficult. However, we appreciate that these laws may have other benefits such as reducing a victim’s average losses and improving a firm’s security and operational practices.”

--- NOTE: my original HP blog can be found here ---

Is the Increase in Security Failures and Privacy Breaches Often Due to Wrongsourcing?

This is the point made by Claudiu Popa, Informatica’s president, as reported by this article:

“Toronto-based Informatica Security Research estimates that the vast majority of issues involving the security and privacy of data, identity theft breaches, compliance failures and other information risk issues are due to poor strategic planning and IT governance.

Informatica’s president, Claudiu Popa is a recognized information risk consultant who sees the issue as a management problem: “we have seen a general trend in North America where we often talk to companies that opt to force their internal IT departments to also manage security. Many organizations fail to realize that security management is not a core competency that neatly fits within IT governance activities. In fact, as companies scramble to achieve compliance with numerous standards and legislation, they often mismanage their operations and impact productivity. It makes no sense to in-source activities that are complex, expensive and often mismanaged instead of hiring qualified experts to get the job done. The flip side of what I call ‘wrong-sourcing’ is that organizations too often choose to outsource their core capabilities. This is backwards and executives should revisit their business objectives."”

--- NOTE: my original HP blog can be found here ---

Are Kids the New Targets of Identity Thefts?

A recent article, titled “Children Becoming Prime Identity Theft Targets”, reports the findings of a recent study by the Identity Theft Resource Center:

“According to a recent study by the Identity Theft Resource Center, based in San Diego, the theft usually takes place early in the child’s life. The researchers found that, in 54 percent of the cases, the theft took place before the child was six years old. The study also found that, while parents or other relatives were the most likely perpetrators, other identity thieves increasingly target children for one simple reason. It’s easy to do, and to get away with for long periods of time before discovery.”

This article also highlights that:

“Of the more than 255,000 identity theft complaints received in 2005 by the Federal Trade Commission, five percent involved people 18 or younger, an increase from three percent in 2003.”

--- NOTE: my original HP blog can be found here ---

US Federal Trade Commission: about 8 million US people estimated being victims of Identity Theft …

A recent report published by the US Federal Trade Commission, called “Federal Trade Commission – 2006 Identity Theft Survey Report” (the report is available online, here) provides an analysis and estimate of Identity Thefts happened in US, in 2005.

Based on this report, “A total of 3.7 percent of survey participants indicated that they had discovered they were victims of ID theft in 2005. This result suggests that approximately 8.3 million U.S. adults discovered that they were victims of some form of ID theft in 2005”.

Identity thefts have been classified in the following categories:

• New Accounts & Other Frauds
• Misuse of Existing Non-Credit Card Accounts or Account Number
• Misuse of Existing Credit Card or Credit Card Number
  

This report estimates that “The median value of goods and services obtained by the identity thieves for all categories of ID theft was $500. Ten percent of victims reported that the thief obtained $6,000 or more, while 5 percent reported that the thief obtained at least $13,000 in goods and services.
…
In more than 50 percent of ID thefts, victims incurred no out-of-pocket expenses. (Out-of-pocket expenses include any lost wages, legal fees, any payment of fraudulent debts, and miscellaneous expenses such as notarization, copying, and postage.) In the New Accounts & Other Frauds category, the median value of out-of-pocket expenses was $40”.

This report also compares these recent findings against findings of a similar investigation carried out in 2003: “The 2003 survey found that 4.6% of the survey population had experienced ID theft during the one year period before the survey was conducted. The 2006 survey found that 3.7% of the survey population had experienced ID theft during 2005. The difference between the rates is not statistically significant. Given the sample sizes and the variances within the samples, one cannot conclude that the apparent difference between the two figures is the result of a real decrease in ID theft rather than a result of random variation.”

--- NOTE: my original HP blog can be found here ---

Technologies and Solutions to Help Fighting Identity Thefts …

A recent article by Brad Stone, titled “In ID Theft, some victims see opportunities”, provides an interesting overview of some emerging technologies and solutions that can help people to be more aware of identity thefts and potentially fight them.

Some emerging companies have interesting ideas and proposals in this space. Have a look …

--- NOTE: my original HP blog can be found here ---

Part II: CIMIP to Release Landmark Study on Identify Theft

As anticipated in my previous post, “CIMIP to Release Landmark Study on Identify Theft”, The CIMIP report, called “Identity Fraud Trends and Patterns: Building a Data-Based Foundation for Proactive Enforcement”, has been released. It can be downloaded, for free, here.

The executive summary of this report mentions that: “The purpose of this study was to provide empirical evidence on which law enforcement can base enhanced proactive identity theft control and prevention efforts. It focuses on identity theft offenders, which sets it apart from previous surveys and other research which have centered on identity theft victims. As a result of the study of closed United States Secret Service cases with an identity theft component (2000-2006), empirical data concerning the key factors relevant to the criminal behavior of identity thieves and the conditions under which that behavior occurs are available to law enforcement agencies and corporate security and fraud investigators for the first time.”

This report covers various topics, including: Goals and Values of the Study, The Empirical Approach, Findings, The Offenders,The Commission of the Crime, Victimization, Recommendations and Conclusions. It is worth reading it: it provides an interesting perspective and analysis on Identity Thefts based on factual information.

--- NOTE: my original HP blog can be found here ---

CIMIP to Release Landmark Study on Identify Theft

This could be of interest to the Identity Management Community. A recent article written by Amanda Damiano (“CMIP to Release Landmark Study”) reveals that:

“On Monday (Oct. 22), Utica College’s Center for Identity Management and Information Protection (CIMIP) will release the results of a landmark study of closed U.S. Secret Service cases involving identity theft. The study, which will reveal new findings about identity theft perpetrators, victims, and methods, marks the first time the U.S. Secret Service has allowed review of its closed case files on identity theft and fraud. The research will be of particular value to government, law enforcement and corporate entities whose mission is to prevent, detect, investigate or prosecute identity theft crimes, said Gary R. Gordon, executive director of CIMIP and professor of economic crime at Utica College. Information on insider threats, points of compromise, and vulnerabilities will be of specific interest to chief security and chief information officers across many industries, including financial services and retail corporations, Gordon said.”

These results will be released at the 18th annual ECI (Economic Crime Institute) Conference (October, 21-23), this year focusing on the topic: “Identity Management and Information Protection: Research and Action”.

--- NOTE: my original HP blog can be found here ---

On Company Policies and Impact on Identity Theft …

Ian Williams’ article, titled “Poor company policy aids identity thefts”, provides an overview of a recent report by Experian:

“Many businesses are still in the dark ages when it comes to making sure customers are who they say they are, reveals a new report by risk management experts Experian.
The report shows that 70 per cent of financial services companies still rely on fraud-friendly paper documents to authenticate a person's identity, and 36 per cent of retailers and 40 per cent of telecommunications companies are still doing it.
According to the survey too many industries are left hamstrung by their reliance on the use of passports, utility bills and driving licences for authentication, despite the fact that electronic systems are generally considered to be safer and faster for all concerned. The report is based on interviews with 1,500 consumers and anti-fraud, risk and compliance experts from 70 businesses in the UK.”

It would be interesting to have a comparative analysis across different countries (e.g. in EU, US, etc.) showing the impact that different companies’ policies have on identity theft.